🚀 Welcome to WorkFlura Setup
Complete the setup to activate your organization's workspace
Loading...
Loading setup status...
Create Your Workspace
Thank you for installing WorkFlura from the Google Workspace Marketplace!
Sign in with your Google Workspace admin account to get started.
Create Your Workspace
Thank you for installing WorkFlura from the Google Workspace Marketplace!
Please provide your company name to initialize your dedicated secure workspace.
?
user@example.com
The name of your organization as it will appear in WorkFlura
Auto-detected from your Google login. You may override this if your organization uses a different domain.
Loading…
Your 30-day trial emulates one of our plans. Pick the size that matches your evaluation — most teams start with Starter; choose Team if you are evaluating across several locations. Nothing is billed; at the end of the trial you choose any plan.
You're signed in as this account — it will be your workspace administrator. You can add more users and billing contacts later in Settings.
personNeeds: owner of a Google Cloud billing account
No Firebase project yet? — a 5-step checklist, about 10 minutes.
Paste the
firebaseConfig block from Firebase
(settingsSettings → Your apps) here:Filled from the config above.
chevron_rightLearn more
- Copying the whole “Add Firebase SDK” snippet (comments, import lines) is fine — WorkFlura picks out the config and reads your project ID from it.
- The web config (
apiKey,appId, …) is not secret; it ships in every browser app. Access is controlled by security rules. - Your data stays in this project. WorkFlura never holds it.
personNeeds: owner of project your Firebase project
- terminalOpen Cloud Shell → console.cloud.google.comopen_in_new (paste your config above first so the right project opens)
- Paste the command, press Enter. When asked Is this the correct project?, type YES.
- When it finishes, select the JSON between the two dashed lines — from
{to the final}— and copy it (⌘C / Ctrl-C). - or click the box below and press ⌘V / Ctrl-V
chevron_rightLearn more
- What the command does: downloads
bootstrapTenant.shfrom WorkFlura and runs it in your project. It enables the Google APIs WorkFlura needs, creates the service accountworkflura-sa@<project-id>.iam.gserviceaccount.com, grants it the minimum roles in this project only, sets a 7-day auto-delete on support exports, and creates one key. Nothing is created outside your project. - Show the command:
(loading…)
- Prefer a file? In Cloud Shell click ⋮ (top-right of the terminal) → Download →
workflura-<project-id>-key.json. Then - The key is secret. WorkFlura encrypts it the moment Initialize succeeds and never shows it again. After Initialize succeeds, delete your copy: in Cloud Shell run
shred -u ~/workflura-<project-id>-key.json; if you downloaded it, delete it from your Downloads folder too. Never email it or commit it to code.
chevron_rightTroubleshooting
- “Your organization blocks creating service-account keys” (the command stops in red): your Google Cloud organization policy blocks keys, and the command could not lift it for this project by itself. Send the message below to your Google Cloud organization admin (someone with the Organization Policy Administrator role). It allows keys for project <project-id> only — nothing else in the organization changes. Once they confirm, run the command again; it continues where it stopped.
Hi — WorkFlura setup needs one service-account key in Google Cloud project <project-id>, and our organization policy blocks key creation. Please allow it for THIS project only (nothing else in the organization changes). In Cloud Shell, as an Organization Policy Administrator, run: for C in iam.disableServiceAccountKeyCreation iam.managed.disableServiceAccountKeyCreation; do printf 'name: projects/<project-id>/policies/%s\nspec:\n rules:\n - enforce: false\n' "$C" > "/tmp/wf-$C.yaml" gcloud org-policies set-policy "/tmp/wf-$C.yaml" --billing-project=<project-id> done Console alternative: IAM & Admin → Organization Policies (project <project-id> selected) → search "service account key creation" → open EACH of the two entries → Manage policy → Override parent's policy → Add a rule → Enforcement: Off → Set policy. Please let me know when it is done. Thank you.
- “NOT_FOUND” / “Cannot access project”: Cloud Shell is signed in as a different Google account than the project owner. Run
gcloud config set account you@yourcompany.comand re-run the command. - Verify key says “Could not read that”: only the JSON block was expected — it starts with
{ "type": "service_account"and ends with the final}. Don’t paste the rest of the terminal output. - “Service-account key belongs to project X, not Y”: the config pasted above and the key come from different projects. Check the project ID.
Already set up? Continue to your workspace →
Use this only if Initialize Workspace already succeeded earlier (for example you came back to this page later). First time here: click Initialize Workspace above.
1
Authorize Form Notifications (Domain-Wide Delegation)
Pending
personNeeds: Google Workspace super admin
Open Domain-wide delegationopen_in_new admin.google.com/ac/owl/domainwidedelegation
- Click Add new.
- Entry A — Client ID:
loading…OAuth scopes:https://www.googleapis.com/auth/forms.body,https://www.googleapis.com/auth/forms.responses.readonly,https://www.googleapis.com/auth/drive.file,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/chat.spaces.create→ click Authorize - Click Add new again.
- Entry B — Client ID:
loading…OAuth scopes:https://www.googleapis.com/auth/forms.body,https://www.googleapis.com/auth/forms.responses.readonly→ click Authorize
chevron_rightLearn more
- Entry A is the service account WorkFlura created in your project (your Firebase project). Its five scopes let WorkFlura create forms, read responses, tidy its own files in your Shared Drive, read your Workspace directory for Load Directory, and open each user’s Google Chat conversation with the notifications app automatically.
- Entry B is WorkFlura’s own service identity. It acts only as one of your System Admins, only to keep Google Forms notifications alive (they expire every 7 days), and only with the two scopes shown. Without Entry B, submissions silently stop after 7 days.
- Already have a row for one of these Client IDs? Click it → Edit → add the scopes to the existing row. Two rows for one Client ID behave unpredictably.
- Load Directory (optional): lets WorkFlura list your Workspace users when you add people. Without it, you add users by typing their email address, which works the same way. It needs a small Workspace admin role, created by a super admin — send them this:
Hi — please create a Workspace admin role for WorkFlura (it only lets WorkFlura list users; nothing else): Admin console (admin.google.com) → Account → Admin roles → Create new role Name: WorkFlura Directory Read Privileges: Admin API privileges → Users → Read (tick only this one) → Create role → Assign role → add: (WorkFlura System Admin email) → Assign role Thank you. - Changes usually apply within minutes but can take up to 24 hours.
chevron_rightTroubleshooting
- Not a super administrator? Only a Google Workspace super admin can open the Domain-wide delegation page and add entries (other admins see no Add new button). Click and send them the message — it contains the link, both Client IDs and both scope lists.
- Your organization uses multi-party approval: a second super admin must approve the request in the Admin console before the authorization takes effect.
- Verify delegation fails right after authorizing: Google can take a few minutes to apply the entries. Wait, then click Verify delegation again before changing anything.
2
Forms Shared Drive
Pending
personNeeds: a Workspace account that can create shared drives
- Open Google Driveopen_in_new → Shared drives → + New
- Name:
WorkFlura→ Create - Open it → Manage members → add
loading…with role Manager → untick Notify people → Share - Copy the ID from the address bar —
drive.google.com/drive/folders/ID— and paste it below.
chevron_rightLearn more
- Files in a shared drive are owned by the drive, not by a person. When people leave, your forms and submissions are unaffected.
- WorkFlura creates every form in this drive and moves its own Apps Script controller here (section 3).
chevron_rightTroubleshooting
- Failed once with “500 / Internal error”? Click Verify Access again. Google’s Forms service occasionally refuses the first request on a brand-new project; the second attempt normally passes.
- Verify Access fails on “Drive write access”: the service account is not a Manager yet, or the ID is wrong. Membership can take a minute to apply.
- Verify Access fails on “Form creation” with 401/403: domain-wide delegation (section 1) is not in effect yet — run Verify delegation there.
3
Apps Script Web App
Pending
personNeeds: the Workspace account that will own the script (a WorkFlura System Admin)
3.1 Choose your shared secret
At least 12 characters. You will paste the same value in 3.3.
chevron_rightLearn more
- Anyone with this secret can call your purge endpoint, so keep it private.
- Coming back later? Leave it blank — your existing secret is kept (it is stored encrypted on your WorkFlura tenant record and never shown again, which is why this field is always empty when you return). Type here only to replace it, and then update
APPS_SCRIPT_SHARED_SECRETin 3.3 to match, or submissions will fail.
3.2 Create the Apps Script project
- Open Apps Scriptopen_in_new → New project
- Click Untitled project (top-left) → name it
Forms Controller→ Rename - In
Code.gsdelete everything → → paste → saveSave - settingsProject Settings (left rail) → tick Show “appsscript.json” manifest file in editor
- codeEditor (left rail) → open appsscript.json → delete everything → → paste → saveSave
- Move the project into your Shared Drive:
- Open Google Driveopen_in_new → Shared drives → WorkFlura → + New → New folder →
Operations - My Drive → right-click Forms Controller → drive_file_moveOrganize → Move → Shared drives → WorkFlura → Operations → Move
- Open Google Driveopen_in_new → Shared drives → WorkFlura → + New → New folder →
chevron_rightLearn more
- Apps Script saves new projects in My Drive, which the WorkFlura service account cannot see. The controller must sit in the same Shared Drive as your forms.
- Move, don’t copy. A copy leaves the original in My Drive and creates a second file that drifts out of sync. There must be exactly one controller, inside the Shared Drive.
- “Forms Controller” is the name support will ask for.
3.3 Set Script Properties
settingsProject Settings (left rail) → scroll to Script Properties → Add script property, three times:
Property 1 of 3
Name:
APPS_SCRIPT_SHARED_SECRET
Value:
(enter your secret in step 3.1 first)
Property 2 of 3
Name:
ACTIVE_FORM_IDS_ENDPOINT
Value:
(loading...)
Property 3 of 3 (optional)
Name:
PURGE_TRIGGER_OWNER
Value:
(loading…)
Click Save script properties.
chevron_rightLearn more
- Property 3 names who owns the response purge in WorkFlura’s alert messages if it ever stops. It defaults to you; use another durable System Admin only if you will not own this script long-term. The purge works without it.
- To confirm the save: leave Project Settings, come back, and the three rows should still be listed.
chevron_rightTroubleshooting
- Submissions fail with an authentication error: the properties were not saved (Apps Script discards them if you navigate away before pressing Save script properties), or the secret here and in 3.1 differ. Add them again and save.
3.4 Install the purge trigger
- scheduleTriggers (left rail) → + Add Trigger (bottom right)
- Set:
- Function to run:
purgeAllFormResponses - Deployment:
Head - Event source:
Time-driven - Type of time-based trigger:
Minutes timer - Minute interval:
Every 10 minutes - Failure notification settings:
Notify me daily
- Function to run:
- Save → when Google asks you to authorize: Advanced → Go to Forms Controller (unsafe) → Allow
chevron_rightLearn more
- The trigger deletes form responses every 10 minutes after WorkFlura has stored them, so personal data does not accumulate in Google Forms.
- Notify me daily emails you only when the trigger fails; there is no “all is well” message. WorkFlura separately alerts your System Admins if the purge heartbeat stops.
- Google shows the “unsafe” warning for every script that is not published to the Marketplace. You own this script, so it is safe to allow.
3.5 Deploy as a web app
- rocket_launchDeploy (top right) → New deployment
- settings next to Select type → Web app
- Description:
WorkFlura Forms Controller - Execute as: Me
- Who has access: Anyone
- Deploy → authorize if asked → copy the Web app URL → paste below
chevron_rightLearn more
- WorkFlura calls this URL with your shared secret, which is why Anyone is required; the secret is what protects it.
- Verify Apps Script saves 3.1 and 3.5, then calls your web app with the secret and asks it for its status. Green means the URL, the secret and the purge trigger are all in place.
chevron_rightTroubleshooting
- “Web app not reachable” / HTML instead of JSON: the deployment is not set to Who has access: Anyone, or the URL is not the one ending in
/exec. Redeploy (Deploy → Manage deployments → edit) and paste the new URL. - “Secret rejected”: the value in 3.1 and the
APPS_SCRIPT_SHARED_SECRETscript property differ, or the properties were not saved. Fix 3.3 and click Verify Apps Script again. - “Purge trigger not installed”: step 3.4 was not completed, or it was created in a copy of the script. There must be exactly one Forms Controller, inside the Shared Drive, with the trigger.
4
Google Chat Bot
Pending
personNeeds: owner of project your WorkFlura project
warningUntick “Build this Chat app as a Workspace add-on” at the top of the Configuration page before you fill in anything else.
- Open Google Chat API configurationopen_in_new (Cloud Console, project your WorkFlura project, Configuration tab)
- App name:
WorkFlura Notifications - Avatar URL:
https://app.sculturats.com/icons/workflura-256-chatbot.png - Description:
Sends workflow notifications - Interactive features: On. Under Functionality leave both boxes unticked.
- Connection settings: HTTP endpoint URL →
- Authentication audience: HTTP endpoint URL (not Project number)
- Visibility: Make this Chat app available to specific people and groups → add the people, or the Google Group, who should receive notifications
- Logs: tick Log errors to Logging
- Save
- Click
— WorkFlura opens your conversation with WorkFlura Notifications (as it does for every user at sign-in) and fills in the ID below.
Filled in by the button above. If you ever need it by hand, it is the part after
/dm/in your conversation’s URL in Google Chat (e.g.mBO2NKAAAAE).Everything else is in place — only Chat notifications are not set up yet.Without a Chat Bot ID, people get in-app notifications only. Finish this section now, or activate the workspace and come back later (Admin Console → Configure System).✅ Preview: User Onboarding LinkUsers will see a button that opens:
Your users: nothing to do. Once they are in the Visibility list (or your Google Group), WorkFlura opens the conversation for them when they sign in or are imported.
chevron_rightLearn more
- WorkFlura sends each person a direct message for submissions, approval requests and status updates.
- Open my Chat conversation does for you what WorkFlura does for everyone else when they sign in: it opens the conversation on your behalf and records its ID. You signed in before this Chat app existed, which is why yours needs the button once.
- The Bot ID is the ID of your own conversation with the app. It is used only to build the Enable notifications button inside WorkFlura; every person’s notifications go to their own conversation.
- Only users in your Workspace domain can receive Chat messages. External participants get in-app notifications.
- A new app can take a few minutes (occasionally a few hours on a brand-new project) to appear in Google Chat.
chevron_rightTroubleshooting
- Google Chat shows “<project> isn’t responding”: Authentication audience is still Project number. Open the Chat API configurationopen_in_new → Configuration tab → Authentication audience → HTTP endpoint URL → Save.
- “Open my Chat conversation” says Google cannot see the app yet: make sure you clicked Save in the Chat API configuration (step j) and that you are in its Visibility list. A new app can take a few minutes to become visible — wait, then click the button again.
- The manual way, if the button keeps failing: Open Google Chatopen_in_new → New chat → search WorkFlura Notifications → open it → send Hi → copy the part after
/dm/in the address bar into the Chat Bot ID field above → Save progress. - Events arrive in a format WorkFlura rejects: “Build this Chat app as a Workspace add-on” was ticked. Untick it and save.
- If Google Chat ever cannot reach WorkFlura, the reason is in your project’s Cloud Logging (that is what Log errors to Logging is for) — support will ask for it first.
5
Regional Settings
Default set
A default is already selected (America/New_York · MM/DD/YYYY). You can leave it as-is or change it — either way it's saved automatically.
6
Check your setup
Pending
Checks everything at once — key, admins, Shared Drive, notification channel, Apps Script, delegation, and a live test form (created and deleted again). Safe to run as often as you like.
Save at any point and come back later. When every item is in place and Check Readiness is green, Save progress activates the workspace and opens the app.
✓
Setup Complete!
Your organization's WorkFlura workspace is now active and ready to use.